RE: [PATCH v3 00/10] Add SBOM generation with debsbom

["'Bouska, Zdenek' via isar-users" <isar-users@googlegroups.com>]

> Yes, definitely. At least in my SPDX SBOM this is listed (need to
> create a CDX one). Are you sure your bash magic is right?

Grub is not in SBOMs even if I look for it by text search.

Reproduce:

$ cat trixie_amd64.yml
header:
  version: 14

build_system: isar

machine: qemuamd64
distro: debian-trixie

target: mc:qemuamd64-trixie:isar-image-base

repos:
  isar:
    path: isar
    layers:
      meta:
      meta-isar:

sudo rm -rf tmp/trixie_amd64_wic
mkdir -p tmp/trixie_amd64_wic
cd tmp/trixie_amd64_wic
git clone https://github.com/ilbers/isar.git
cd isar
git checkout next
git am ../../../isar-v3-Add-SBOM-generation-with-debsbom.patch
cd ..
isar/kas/kas-container --runtime-args --net=host build ../../trixie_amd64.yml
grep grub build/tmp/deploy/images/qemuamd64/isar-image-base-debian-trixie-qemuamd64.wic.cdx.json
grep grub build/tmp/deploy/images/qemuamd64/isar-image-base-debian-trixie-qemuamd64.wic.spdx.json
grep grub build/tmp/deploy/images/qemuamd64/isar-image-base-debian-trixie-qemuamd64.wic.manifest


I still got these SHA256 warnings, same as with custom kernel:

$ debsbom download --outdir downloads --sources tmp/trixie_amd64_wic/build/tmp/deploy/images/qemuamd64/isar-image-base-debian-trixie-qemuamd64.wic.cdx.json
WARNING:debsbom.download.resolver:no sha256 digest for linux@6.12.48-1. Lookup will be imprecise
WARNING:debsbom.download.resolver:no sha256 digest for linux-signed-amd64@6.12.48+1. Lookup will be imprecise
WARNING:debsbom.download.resolver:no sha256 digest for openssl@3.5.1-1+deb13u1. Lookup will be imprecise
downloading 232 files, 545 MiB (cached: 0, 0 KiB)

> Hi, this means that the package was not found in the apt-cache. Did you
> try this series with a fresh build-dir (sstate cache is ok)?
>
Warnings with custom patched kernel are these. Now I made sure, that I deleted build dir:
WARNING:debsbom.download.resolver:no sha256 digest for linux-mainline@6.17.2+r0. Lookup will be imprecise
WARNING:debsbom.commands.download:not found upstream: linux-mainline@6.17.2+r0  <- this is expected 
WARNING:debsbom.download.resolver:no sha256 digest for openssl@3.5.1-1+deb13u1. Lookup will be imprecise

Zdenek Bouska

-- 
Siemens, s.r.o
Foundational Technologies

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/AS1PR10MB5675F15271BD5D53AF21125FEBFCA%40AS1PR10MB5675.EURPRD10.PROD.OUTLOOK.COM.